Up Yours
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
kOS' main claim to fame is (was) the deadly Up Yours email bomber... UY3 is now out there with a lot more to offer ...
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 techniqueeven Captain Crunch got mailbombed by our program... he received in excess of three thousand e-mails and subscriptions for mailing lists
Impact
2 techniquesLast week Infowar.com announced that a new Denial of Service program, Up Yours 4.0 was to be released on Easter Sunday.
kOS' main claim to fame is (was) the deadly Up Yours email bomber... Someone used Up yours to blow Rush Limbaugh off of the net and it has been used repeatedly to blast at the white house address.
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A named denial-of-service attack tool/program discussed as having multiple versions and planned features including DoS capabilities, a Usenet spammer, POP3 hacking functionality, and future IRC automation.
An email bombing tool used to flood targets with large volumes of email and mailing list subscriptions, described as supporting anonymous operation through header manipulation and SMTP server selection.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.